Jose Martinez
7378e9977c
- Puerto 3 eqt-lab-st01-sw01: trunk, native 108 (APs), tagged 100+101 - VLAN 111 WAN sin subnet ni appliance_ip (switching puro) - subnet/appliance_ip pasan a ser opcionales en el módulo
175 lines
5.8 KiB
HCL
175 lines
5.8 KiB
HCL
# Configuración de switches MS - BCN01-LAB
|
|
# El shared secret de RADIUS se pasa via TF_VAR_radius_secret (GitHub secret: RADIUS_SECRET)
|
|
|
|
# --- POLÍTICAS DE ACCESO 802.1X ---
|
|
switch_access_policies = [
|
|
{
|
|
name = "DOT1X-CORPO"
|
|
access_policy_type = "Hybrid authentication"
|
|
host_mode = "Multi-Auth"
|
|
radius_accounting_enabled = false
|
|
radius_re_authentication_interval = 0
|
|
url_redirect_walled_garden_enabled = false
|
|
|
|
# VLAN a la que cae el puerto si el RADIUS no responde
|
|
radius_failed_auth_vlan_id = 101 # GUEST
|
|
|
|
radius_servers = [
|
|
{
|
|
host = "15.15.15.15"
|
|
port = 1912
|
|
}
|
|
]
|
|
}
|
|
]
|
|
|
|
# --- PUERTOS DE SWITCH ---
|
|
# El serial aparece en Dashboard > Switches > nombre del switch > Overview.
|
|
# access_policy_number: número auto-asignado por Meraki a la política creada arriba
|
|
# (visible en Dashboard > Switches > Switch settings > Access policies)
|
|
#
|
|
# Ejemplo con los tres tipos de puerto:
|
|
# switch_port_configs = [
|
|
#
|
|
# # Puertos de acceso general con 802.1X (PCs, portátiles)
|
|
# # Autenticación: 802.1X → MAB → VLAN GUEST si falla RADIUS
|
|
# # La VLAN final la asigna Okta dinámicamente; vlan=100 es el fallback estático
|
|
# {
|
|
# serial = "XXXX-XXXX-XXXX"
|
|
# port_range = "1-20"
|
|
# type = "access"
|
|
# vlan = 100 # ACCESS - fallback si Okta no devuelve VLAN
|
|
# access_policy_type = "Custom access policy"
|
|
# access_policy_number = 1 # id de la política DOT1X-CORPO
|
|
# },
|
|
#
|
|
# # Puertos designados para impresoras (sin 802.1X)
|
|
# # VLAN asignada estáticamente en el puerto - las Group Policies en switches no asignan VLAN
|
|
# {
|
|
# serial = "XXXX-XXXX-XXXX"
|
|
# port_range = "21-24"
|
|
# type = "access"
|
|
# vlan = 103 # PRINTERS - VLAN fija en el puerto
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# # Puertos designados para APs (sin 802.1X)
|
|
# # Igual que impresoras: VLAN fija en el puerto
|
|
# {
|
|
# serial = "XXXX-XXXX-XXXX"
|
|
# port_range = "25-27"
|
|
# type = "access"
|
|
# vlan = 108 # APs - VLAN fija en el puerto
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# # Puerto de uplink (trunk, sin autenticación)
|
|
# {
|
|
# serial = "XXXX-XXXX-XXXX"
|
|
# port_range = "28"
|
|
# type = "trunk"
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# ]
|
|
switch_port_configs = []
|
|
|
|
# --- PUERTOS DE STACK ---
|
|
# Terraform resuelve automáticamente los seriales de todos los miembros del stack.
|
|
# El stack_name debe coincidir exactamente con el nombre en Dashboard > Switches > Stacks.
|
|
# Terraform aplicará el mismo port_range a CADA switch del stack (ambos de 48 puertos).
|
|
#
|
|
# Ejemplo para bnc01-lab-stack01 (2x 48 puertos):
|
|
# switch_stack_port_configs = [
|
|
#
|
|
# # Puertos 1-44: acceso general con 802.1X (PCs, portátiles)
|
|
# {
|
|
# stack_name = "bnc01-lab-stack01"
|
|
# port_range = "1-44"
|
|
# type = "access"
|
|
# vlan = 100 # ACCESS - fallback si Okta no devuelve VLAN
|
|
# access_policy_type = "Custom access policy"
|
|
# access_policy_number = 1 # id de la política DOT1X-CORPO
|
|
# },
|
|
#
|
|
# # Puertos 45-46: impresoras (VLAN fija, sin 802.1X)
|
|
# {
|
|
# stack_name = "bnc01-lab-stack01"
|
|
# port_range = "45-46"
|
|
# type = "access"
|
|
# vlan = 103 # PRINTERS
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# # Puertos 47-48: APs (VLAN fija, sin 802.1X)
|
|
# {
|
|
# stack_name = "bnc01-lab-stack01"
|
|
# port_range = "47-48"
|
|
# type = "access"
|
|
# vlan = 108 # APs
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# ]
|
|
switch_stack_port_configs = [
|
|
{
|
|
stack_name = "bcn01-lab-stack01"
|
|
port_range = "6"
|
|
type = "access"
|
|
vlan = 101 # GUEST
|
|
access_policy_type = "Open"
|
|
},
|
|
{
|
|
# Puerto 47: uplink trunk en ambos miembros del stack
|
|
# VLAN nativa 109 (MANAGEMENT), permite todas las VLANs
|
|
stack_name = "bcn01-lab-stack01"
|
|
port_range = "47"
|
|
name = "Uplink trunk"
|
|
type = "trunk"
|
|
vlan = 109 # MANAGEMENT - VLAN nativa (untagged)
|
|
allowed_vlans = "all"
|
|
access_policy_type = "Open"
|
|
},
|
|
]
|
|
|
|
# Puertos de un switch concreto (miembro individual del stack)
|
|
# El serial se encuentra en: Dashboard > Switches > eqt-lab-st01-sw01 > Overview
|
|
switch_named_port_configs = [
|
|
{
|
|
# Puerto 1 de eqt-lab-st01-sw01 → VLAN SERVERS (estática, sin autenticación)
|
|
switch_name = "eqt-lab-st01-sw01"
|
|
port_range = "1"
|
|
name = "Servers"
|
|
type = "access"
|
|
vlan = 110 # SERVERS
|
|
access_policy_type = "Open"
|
|
},
|
|
{
|
|
# Puerto 3 de eqt-lab-st01-sw01 → AP (trunk, nativa 108 APs, tageadas 100 ACCESS y 101 GUEST)
|
|
switch_name = "eqt-lab-st01-sw01"
|
|
port_range = "3"
|
|
name = "AP"
|
|
type = "trunk"
|
|
vlan = 108 # APs - VLAN nativa (untagged)
|
|
allowed_vlans = "100,101,108" # ACCESS + GUEST + APs
|
|
access_policy_type = "Open"
|
|
},
|
|
]
|
|
|
|
# VLAN de gestión de los switches del site
|
|
switch_management_vlan = 109
|
|
|
|
# Interfaces L3 en el stack para acceso de gestión al Dashboard de Meraki
|
|
stack_routing_interfaces = [
|
|
{
|
|
stack_name = "bcn01-lab-stack01"
|
|
name = "MANAGEMENT"
|
|
vlan_id = 109
|
|
ip_address = "10.2.55.2"
|
|
subnet = "10.2.55.0/24"
|
|
default_gateway = "10.2.55.1"
|
|
dns1 = "8.8.8.8"
|
|
dns2 = "8.8.4.4"
|
|
},
|
|
]
|